PT-2025-48106 · Db Elettronica Telecomunicazioni Spa · Mozart Fm Transmitter

Abdul Mhanni · Published 2025-11-26 · Updated 2025-12-24 · CVE-2025-66254

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30 through 7000

Description An unauthenticated attacker can delete arbitrary files. The deleteupgrade parameter within the /var/www/upgrade contents.php file allows for the deletion of files located in the /var/www/upload/ directory without any restrictions on file extensions or path sanitization. This enables the removal of critical system files.

Recommendations Mozart FM Transmitter version 30: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mozart FM Transmitter version 50: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mozart FM Transmitter version 100: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mozart FM Transmitter version 300: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mozart FM Transmitter version 500: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mozart FM Transmitter version 1000: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mozart FM Transmitter version 2000: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mozart FM Transmitter version 3000: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mozart FM Transmitter version 3500: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mozart FM Transmitter version 6000: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mozart FM Transmitter version 7000: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-66254

Affected Products

Mozart Fm Transmitter

References · 6

• 🔥 https://abdulmhsblog.com/posts/webfmvulns · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66254 · Security Note
• https://twitter.com/VulmonFeeds/status/1993555489028776051 · Twitter Post
• https://twitter.com/SecReportCVE/status/2003871789307351432 · Twitter Post
• https://t.me/cveNotify/144299 · Telegram Post
• https://t.me/CVEtracker/38245 · Telegram Post